Improper Authentication Vulnerability (CVE‑2021‑32030) Impacts ASUS Lyra Mini & GT‑AC2900 Routers
What It Is – A CVE‑2021‑32030 improper‑authentication flaw in the web‑based admin interface of ASUS Lyra Mini and GT‑AC2900 routers permits an unauthenticated attacker to obtain administrative privileges.
Exploitability – Publicly disclosed; proof‑of‑concept code is available. The NVD assigns a CVSS v3.1 base score of 7.5 (High), indicating a realistic path to remote compromise.
Affected Products – ASUS Lyra Mini (model R1) and ASUS GT‑AC2900 (model GT‑AC2900). Both models may already be end‑of‑life or end‑of‑service.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous asset inventory and lifecycle management – unmanaged or obsolete devices become a blind spot in audit evidence.
- Highlights gaps in authentication and privileged‑access controls that map to a core VCF control objective for identity assurance.
- Forces organizations to collect defensible logs of admin‑interface activity, a prerequisite for a credible audit trail and for meeting buyer‑driven trust requirements.
Recommended Actions
- Inventory all network devices; flag any ASUS Lyra Mini or GT‑AC2900 units.
- Verify firmware version; apply the vendor‑released patch or replace devices that are EoL/EoS.
- Enforce strong, unique admin credentials and disable remote‑admin access where not required.
- Segment management traffic and enable logging of all admin‑interface sessions.
- Incorporate the remediation steps into your continuous control‑monitoring program to generate audit‑ready evidence.
Source: CISA KEV – CVE‑2021‑32030